[java-identity-provider] branch master updated: Strip down default MFA example.

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch master
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=1bba47ac52b81a3f0aacd9a65de1b1eb7ee5d61c

The following commit(s) were added to refs/heads/master by this push:
       new  1bba47a   Strip down default MFA example.
1bba47a is described below

commit 1bba47ac52b81a3f0aacd9a65de1b1eb7ee5d61c
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Jul 30 08:28:56 2019 -0400

    Strip down default MFA example.
---
 .../main/resources/conf/authn/mfa-authn-config.xml | 29 +++-------------------
 1 file changed, 3 insertions(+), 26 deletions(-)

diff --git a/idp-conf/src/main/resources/conf/authn/mfa-authn-config.xml b/idp-conf/src/main/resources/conf/authn/mfa-authn-config.xml
index f1b3918..3bfbcbb 100644
--- a/idp-conf/src/main/resources/conf/authn/mfa-authn-config.xml
+++ b/idp-conf/src/main/resources/conf/authn/mfa-authn-config.xml
@@ -56,40 +56,17 @@
     </util:map>
 
     <!-- Example script to see if second factor is required. -->
-    <bean id="checkSecondFactor" parent="shibboleth.ContextFunctions.Scripted" factory-method="inlineScript"
-        p:customObject-ref="shibboleth.AttributeResolverService">
+    <bean id="checkSecondFactor" parent="shibboleth.ContextFunctions.Scripted" factory-method="inlineScript">
         <constructor-arg>
             <value>
             <![CDATA[
                 nextFlow = "authn/Password";
 
-                // Go straight to second factor if we have to, or set up for an attribute lookup first.
+                // Check if second factor is necessary for request to be satisfied.
                 authCtx = input.getSubcontext("net.shibboleth.idp.authn.context.AuthenticationContext");
                 mfaCtx = authCtx.getSubcontext("net.shibboleth.idp.authn.context.MultiFactorAuthenticationContext");
                 if (mfaCtx.isAcceptable()) {
-                    // Attribute check is required to decide if first factor alone is enough.
-                    resCtx = input.getSubcontext(
-                        "net.shibboleth.idp.attribute.resolver.context.AttributeResolutionContext", true);
-                    rpCtx = input.getSubcontext("net.shibboleth.idp.profile.context.RelyingPartyContext");
-                    resCtx.setAttributeRecipientID(rpCtx.getRelyingPartyId());
-
-                    // Look up the username using a standard function.
-                    usernameLookupStrategyClass
-                        = Java.type("net.shibboleth.idp.session.context.navigate.CanonicalUsernameLookupStrategy");
-                    usernameLookupStrategy = new usernameLookupStrategyClass();
-                    resCtx.setPrincipal(usernameLookupStrategy.apply(input));
-                        
-                    resCtx.getRequestedIdPAttributeNames().add("allowedLoginMethods");
-                    resCtx.resolveAttributes(custom);
-                    
-                    // Check for an attribute that authorizes use of first factor.
-                    attribute = resCtx.getResolvedIdPAttributes().get("allowedLoginMethods");
-                    valueType =  Java.type("net.shibboleth.idp.attribute.StringAttributeValue");
-                    if (attribute != null && attribute.getValues().contains(new valueType("IPAddress"))) {
-                        nextFlow = null;
-                    }
-                    
-                    input.removeSubcontext(resCtx);   // cleanup
+                    nextFlow = null;
                 }
                 
                 nextFlow;   // pass control to second factor or end with the first

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.